Re: [OAUTH-WG] Securing APIs with OAuth 2.0

1. Yes, client credentials sounds right for what you described. Think of it
as lightweight b2b authentication in that sense (but two steps - one to get
a token, and another to use it).
2. Can't help you with source - but do have a product-based solution :)
3. Absolutely it should for the resource server, but the answer may depend
have same dependency on the implementation you use.

Regards,
Shane.

From:	Pete Clark <pete@appmuscle.com>
To:	"oauth@ietf.org" <oauth@ietf.org>
Date:	29/02/2012 06:50 PM
Subject:	[OAUTH-WG] Securing APIs with OAuth 2.0
Sent by:	oauth-bounces@ietf.org

Hey all, I've joined the list because I'd like to use OAuth 2 to implement
security for a new set of REST APIs I'm developing for a client.  I'm
coding with PHP, but my questions are more general.  Right now, there will
be only one web site that uses the APIs, in a server-to-server fashion, and
currently we don't have a need for a third party application to gain access
to user data, such that a user would need to authorize that app.  We do,
however, want to have that ability down the road.  My question is, can I
still use OAuth 2 in some way to implement our first phase?  From what I've
read, it seems like the "client credentials" flow is the one I want to use
for now.  Can someone:

1) Confirm that that's what I should use for this first phase?
2) Point me to an implementation of this flow (in any language) that I
could use or port to PHP?  I've found some libraries for php but can't
really tell, being new, if they offer the "client credentials" flow
3) Answer one more question.. Will using the client credentials flow now
allow me to move to one of the user-authorizes-external-app flows down the
road without having to reimplement or throw away the client credentials
flow code?

I apologize for all the questions, but these would really help point me in
the right direction.. Thank you for reading!

Sincerely,
Pete

_______________________________________________
OAuth mailing list
OAuth@ietf.org
https://www.ietf.org/mailman/listinfo/oauth